【摘要】 针对计算机证据格式繁杂不利于形成证据链的问题,提出了计算机证据元数据表示方法。该方法将计算机证据的描述层次划分为数据表示层、证据表示层、事件表示层和案件表示层,并在这些层次上分别采用证据元数据来描述计算机证据。通过对计算机异常事件证据元数据的设计,实现对计算机证据的内在属性和关系进行统一的表达,能够方便地组织、分析、融合和提交计算机证据。更多还原

【Abstract】 In view of the difficulty of constructing evidential chain due to the miscellaneous format of the computer evidence,a notation method for the computer evidential metadata was proposed. The objects were described by different form of computer evidential metadata in the data-level,the evidence-level,the event-level and the case-level. The computer evidential metadata of computer abnormal event was designed. The results indicate that the attributes and relations of computer evidence can be expressed uniformly,and the computer evidence can be organized,analyzed,melted and submitted conveniently.更多还原